Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-25120

Good to know:

icon

Date: February 13, 2024

TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.

Language: PHP

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2024-25120
https://github.com/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c
https://github.com/TYPO3/typo3/commit/2de87ff113ba24333ab7cbb8078588743f8958d6
https://github.com/TYPO3/typo3/commit/33f4d279b82bca0a509227a17065244c6156e68f
https://typo3.org/security/advisory/typo3-core-sa-2024-005
https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html#resource-references
https://github.com/TYPO3/typo3/commit/ae0dfc4c058a90c10eedb3f49cfaf33164d21cdd
https://github.com/TYPO3/typo3
https://www.mend.io/vulnerability-database/CVE-2024-25120

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Information Leak / Disclosure

CWE-200

Top Fix

icon

Upgrade Version

Upgrade to version v8.7.57,v9.5.46,v10.4.43,v11.5.35,v12.4.11,v13.0.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us